    [cylon.session :refer (create-session! assoc-session! ->cookie get-session-value get-cookie-value get-session)]
    [ring.middleware.cookies :refer (wrap-cookies cookies-request cookies-response)]))
 
+(def SESSION-ID "session-id")
+
 (defrecord AuthorizationServer [store scopes iss]
 
   WebService

                                  "%s?code=%s&state=%s"
                                  callback-uri code state
                                  )}
                       :cookies {"session-id" (->cookie session)}}))))
               ;; Fail
               {:status 302
                :headers {"Location" (format "%s" (path-for (:modular.bidi/routes req) ::get-authenticate-form))}


                     (cookies-response {:status 302
                       :headers {"Location" (path-for (:modular.bidi/routes req) ::get-totp-code)}
                       :cookies {SESSION-ID (->cookie session)}}))

                   ;; So it's not 2FA, continue with OAuth exchange
                   ;; Generate the temporary code that we'll exchange for an access token later
